Privacy Policy 隐私政策
Last updated · October 17, 2026 最后更新 · 2026 年 10 月 17 日The short version 简版摘要
- ✓Credentials never leave your device's Keychain, unless you turn on iCloud Keychain sync yourself.
- ✓Terminal sessions connect directly from your device to the servers you configured. We have no relay in the middle.
- ✓Voice audio is sent only while you hold the mic button, and only to the recognition engine you chose.
- ✓No analytics, no advertising, no trackers, no data selling. There is nothing to opt out of.
- ✓凭据只存在你设备的钥匙串里——除非你亲手打开 iCloud 钥匙串同步。
- ✓终端会话从你的设备直连你自己配置的服务器，中间没有我们的中转。
- ✓语音音频只在你按住麦克风时发送，且只发给你选定的识别引擎。
- ✓无统计、无广告、无跟踪、无数据买卖——没有任何需要你手动关闭的选项。
§ 01Overview概览
DevPilot is an SSH terminal and agent cockpit for iPhone and iPad. It is built on a simple data posture: your servers, your credentials and your sessions belong to you. The app works without accounts, sign-ups, or developer-run infrastructure for its core features, and it does not collect personal information of its own.
This policy explains every place your data can go: on your device, to Apple, and to the third-party services you choose to switch on. When you use a feature that involves a third party — such as Deepgram cloud transcription or Tailscale networking — that provider processes data under its own privacy policy, and this document tells you exactly when and what.
DevPilot 是一款运行在 iPhone 和 iPad 上的 SSH 终端与 Agent 驾驶舱，产品建立在一条简单的数据立场上：你的服务器、你的凭据、你的会话，都只属于你。核心功能无需注册账号、无需登录，也不依赖开发者运营的服务器；App 自身不收集任何个人信息。
本政策说明你的数据可能去往的每一个地方：你的设备、Apple，以及由你主动开启的第三方服务。当你使用涉及第三方的功能（如 Deepgram 云端转写或 Tailscale 组网）时，由该服务商依其自身隐私政策处理数据——本文件会明确说明发生在何时、涉及什么。
§ 02Data that stays on your device仅存于本机的数据
The following data never leaves your device, unless you explicitly turn on iCloud sync (§03) or connect to a server you configured (§06):
- Host list and connection settings (address, port, username) — stored in the app's local database.
- SSH passwords, private keys and key passphrases — stored in the iOS Keychain, never inside the app database.
- Trusted host key fingerprints — the SHA-256 fingerprint of each server you accept on first connect (a "trust on first use" record), stored in a local file and checked on every later connection.
- Button schemes, command snippets and preferences (appearance, font size, scrollback, voice settings).
- Session state used to restore your workspace after relaunch.
- Tailscale node keys, if you use the embedded networking feature (§07).
DevPilot ships no analytics or crash-reporting SDK. Diagnostic logs are written by iOS and stay on your device; whether crash logs are shared with anyone is governed entirely by your iOS settings.
If you delete the app, its local database, files and preferences are removed. iOS may retain Keychain items after an app is uninstalled; removing a host inside DevPilot always deletes that host's stored credentials along with it.
以下数据绝不离开你的设备——除非你主动开启 iCloud 云同步（§03），或连接你自己配置的服务器（§06）：
- 主机清单与连接设置（地址、端口、用户名）——存于 App 本地数据库。
- SSH 密码、私钥与私钥口令——存于 iOS 钥匙串（Keychain），绝不落入 App 数据库。
- 已信任的主机密钥指纹——你首次连接时接受的服务器 SHA-256 指纹（「首次信任即记录」），存于本地文件，并在之后每次连接时校验。
- 悬浮按钮方案、快捷指令与偏好设置（外观、字号、回滚行数、语音设置等）。
- 会话状态——用于重启后恢复你的工作区。
- Tailscale 节点密钥（如你使用内置组网功能，§07）。
DevPilot 不内置任何统计或崩溃上报 SDK。诊断日志由 iOS 写入并留在你的设备上；崩溃日志是否与任何人共享，完全由你的 iOS 系统设置决定。
卸载 App 会同时删除其本地数据库、文件与偏好设置。iOS 可能会在卸载后保留钥匙串条目；在 DevPilot 内删除某台主机时，与该主机关联的凭据一定会被一并删除。
§ 03iCloud sync (optional)iCloud 云同步（可选）
Sync is a Pro feature and is off until you switch it on. When enabled, five data domains — host lists (without credentials), button schemes, command snippets, preferences, and trusted host keys (hostnames, ports and fingerprints) — are stored in your personal iCloud through Apple's key-value storage, and stay in sync across the devices where you are signed in with the same Apple ID.
SSH credentials (passwords and keys) and third-party API keys can additionally sync through iCloud Keychain. Each of these has its own separate switch, and both are off by default.
云同步是 Pro 功能，在你亲手打开之前始终关闭。开启后，五个数据域——主机清单（不含凭据）、悬浮按钮方案、快捷指令、偏好设置、已信任主机密钥（主机名、端口与指纹）——经由 Apple 的键值存储存入你个人的 iCloud，并在登录同一 Apple ID 的设备间保持同步。
SSH 凭据（密码与密钥）和第三方 API 密钥可另外通过 iCloud 钥匙串同步。这两类各有独立开关，且默认全部关闭。
§ 04Voice recognition语音识别
Voice input is optional and works in two modes:
- System dictation (default). Handled by iOS itself. When your device and language support it, DevPilot requests fully on-device processing — nothing is sent anywhere. When on-device models are not available for your language, dictation is handled by Apple, under Apple's privacy policy. Audio in this mode never reaches us.
- Deepgram cloud transcription (optional). You bring your own Deepgram API key, which is stored in the Keychain. Audio is streamed to Deepgram over an encrypted connection only while you hold the mic button, and used only to produce text. We never receive your audio, your transcript, or your API key. You can delete the key at any time in Settings → Voice input.
DevPilot keeps no copy of any audio or transcript beyond the recognized text you choose to insert into the terminal.
语音输入是可选功能，有两种模式：
- 系统听写（默认）。由 iOS 自身处理。当设备与语言支持时，DevPilot 强制要求完全在设备端处理——不向任何地方发送。当你的语言没有设备端模型时，听写由 Apple 处理，适用 Apple 隐私政策。该模式下的音频不会到达我们。
- Deepgram 云端转写（可选）。使用你自备的 Deepgram API Key，存于钥匙串。音频经加密连接流向 Deepgram——仅在你按住麦克风期间，且仅用于生成文字。我们永远不会收到你的音频、转写文本或 API Key。你可以随时在「设置 → 语音输入」中删除 Key。
除了你选择插入终端的识别文本，DevPilot 不保留任何音频或转写副本。
§ 05Purchases & Pro entitlements购买与 Pro 权益
Subscriptions and purchases are handled entirely by Apple through the App Store. DevPilot never sees your name, email address, or payment details.
Pro entitlements are verified on your device through Apple's StoreKit. DevPilot also contains an optional server-side verification service to support entitlement restoration across devices. It is disabled unless switched on at the service level, and even when enabled it receives only:
- a random anonymous identifier, generated on your device — not linked to your Apple ID, name, email or device identifiers. If you use iCloud Keychain, it may follow you across your own devices through Apple's encrypted sync;
- the app version;
- App Store transaction IDs for your purchases, used to verify and restore Pro on your devices, and to count anonymous active installs.
Nothing else is transmitted — no device fingerprints, no location, no usage statistics beyond that anonymous count, and no content of anything you do in the app.
订阅与购买完全由 Apple 通过 App Store 处理。DevPilot 看不到你的姓名、邮箱或支付信息。
Pro 权益通过 Apple 的 StoreKit 在你的设备上完成校验。DevPilot 另含一个可选的服务端权益校验服务，用于跨设备恢复权益：在服务端未开启时它不会运行；即使开启，它也只会收到：
- 一个随机的匿名标识符——在你的设备上生成，与你的 Apple ID、姓名、邮箱或设备标识无关。若你使用 iCloud 钥匙串，它可能经 Apple 的加密同步跟随你自己的设备；
- App 版本号；
- 你所购项目的 App Store 交易 ID——用于在你的设备上校验与恢复 Pro 权益，以及统计匿名活跃安装数。
除此之外不传输任何内容——没有设备指纹、没有位置、没有匿名计数之外的用量统计，更没有你在 App 内操作的任何内容。
§ 06Your servers, SSH & image uploads你的服务器、SSH 与图片上传
All SSH and SFTP traffic goes directly from your device to the hosts you configure, over SSH's standard encryption. DevPilot operates no proxy or relay — we cannot observe your sessions, commands, or files, even if we wanted to.
Image upload works the same way: when you pick or take a photo, it is normalized on your device (resized to at most 2048 px) and uploaded via SFTP into ~/devpilot-uploads/ on your server. Photos go nowhere else, and the camera is only used when you choose to take a photo.
所有 SSH 与 SFTP 流量都从你的设备直连你配置的主机，走 SSH 标准加密。DevPilot 不设任何代理或中转——即使想看，我们也看不到你的会话、命令或文件。
图片上传同理：当你挑选或拍摄照片时，图片先在你的设备上完成规范化（最长边缩至 2048 px 以内），再经 SFTP 上传到你自己的服务器的 ~/devpilot-uploads/ 目录。照片不会去往其他任何地方；相机也只在你主动选择拍摄时才会被使用。
§ 07Tailscale networking (optional)Tailscale 组网（可选）
DevPilot can embed a Tailscale node (userspace networking — it does not occupy the system VPN slot) so you can reach machines in your own tailnet. Joining a tailnet involves Tailscale's coordination service and relays, which are operated by Tailscale Inc. under Tailscale's privacy policy.
Your node's keys are stored on your device; the auth key you paste is stored in the Keychain. Your SSH traffic still terminates at your own machines — Tailscale's coordination server arranges connections but cannot read encrypted SSH content.
DevPilot 可以在应用内嵌一个 Tailscale 节点（用户态组网——不占用系统 VPN 槽位），让你连上你自己的 tailnet。加入 tailnet 会涉及 Tailscale 的协调服务与中继，由 Tailscale Inc. 运营，适用 Tailscale 隐私政策。
你的节点密钥存于设备本地；你粘贴的 AuthKey 存于钥匙串。SSH 流量的终点依然是你自己的机器——Tailscale 的协调服务器只负责牵线搭桥，无法读取加密的 SSH 内容。
§ 08Notifications & Shortcuts通知与快捷指令
Custom notification channels. You can point DevPilot at a notification service you control — ntfy.sh, Bark, or a self-hosted webhook. The endpoint addresses (and any access tokens you enter) are stored on your device, and test notifications are sent only to the endpoints you entered. DevPilot runs no push infrastructure of its own.
App Shortcuts, Siri and widgets. Shortcuts run against your existing SSH sessions on your own hosts. Live Activities and home-screen widgets display session status locally on your device and send nothing anywhere.
自定义通知通道。你可以把 DevPilot 指向你掌控的通知服务——ntfy.sh、Bark 或自建 webhook。通道地址（以及你填入的访问令牌）只存在你的设备上，测试通知也只发往你填写的端点。DevPilot 自身不运营任何推送基础设施。
快捷指令、Siri 与小组件。快捷指令在你自己主机的既有 SSH 会话上执行。实时活动与桌面小组件只在你的设备上本地展示会话状态，不向任何地方发送数据。
§ 09What we never do我们的底线
§ 10Third parties at a glance第三方服务一览
Every outside service DevPilot can touch, and when:
AppleApple
iCloud · Keychain · dictation · App Store
iCloud sync and iCloud Keychain only when you enable them; system dictation whenever voice input is used; payments for Pro. Data is processed by Apple under Apple's privacy policy.
仅当你开启时经 iCloud 云同步与 iCloud 钥匙串；语音输入经系统听写；Pro 购买经 App Store。数据由 Apple 依 Apple 隐私政策处理。
Deepgram
cloud speech-to-text · opt-in
Receives microphone audio only if you select Deepgram as your engine and provide your own API key — and only while you hold the mic button. Governed by Deepgram's legal terms.
仅当你在设置中选择 Deepgram 并填入自己的 API Key 时，才会收到麦克风音频——且仅在你按住麦克风期间。适用 Deepgram 法律条款。
Tailscale
coordination & relays · opt-in
Coordinates connections for your tailnet when the embedded networking feature is on. Governed by Tailscale's privacy policy; it cannot read your encrypted SSH traffic.
内置组网功能开启时，为你的 tailnet 协调连接。适用 Tailscale 隐私政策；它无法读取你加密的 SSH 流量。
Your servers你的服务器
SSH · SFTP · webhooks
Everything you do in a terminal goes to the hosts and endpoints you configured, directly from your device, over encrypted connections.
你在终端里做的一切都直接发往你配置的主机与端点——从你的设备出发，走加密连接。
No other third party receives data from DevPilot. There are no ad networks, no social SDKs, no font or script CDNs inside the app.
除上述服务外，DevPilot 不向任何第三方发送数据。App 内没有广告网络、没有社交 SDK、没有字体或脚本 CDN。
§ 11Your choices & rights你的选择与权利
You are in control, inside the app:
- iCloud sync — turn the master switch or the credentials/API-key switches on or off at any time in Settings → iCloud sync.
- Credentials — deleting a host removes its stored password or key and its trusted fingerprint. You can also clear API keys in their respective settings pages.
- Voice input — simply don't use the mic button, or switch engines; nothing records unless you press and hold.
- Everything local — uninstalling the app removes its local data (see §02).
Because DevPilot has no accounts, there is no user profile for us to export, correct or delete. Data that concerns you lives on your device and in your Apple iCloud, where Apple's privacy tools govern access, export and deletion. Where regulations such as the GDPR or CCPA apply, our practical data footprint is close to zero — and if server entitlement verification is enabled and you want the anonymous record tied to your purchases removed, contact us (§15) and we will delete it.
在 App 内，一切由你掌控：
- iCloud 云同步——随时在「设置 → iCloud 云同步」开关总开关或凭据 / API 密钥两个独立开关。
- 凭据——删除主机会连带删除其存储的密码或密钥与已信任指纹。你也可以在相应设置页随时清除 API Key。
- 语音输入——不用麦克风按键即可完全不触发，或切换引擎；不按住就绝不录音。
- 一切本地数据——卸载 App 即删除（见 §02）。
DevPilot 没有账号体系，因此我们这边不存在可供导出、更正或删除的用户档案。与你相关的数据都在你的设备与 Apple iCloud 中，由 Apple 的隐私工具管理访问、导出与删除。在 GDPR、CCPA 等法规适用之处，我们的实际数据足迹趋近于零——若服务端权益校验已开启、而你希望删除与购买绑定的匿名记录，联系我们（§15），我们会删除。
§ 12Children's privacy儿童隐私
DevPilot is a professional tool and is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from anyone — including children.
DevPilot 是一款专业工具，不面向 13 岁以下（或你所在司法辖区同等最低年龄）的儿童。我们对任何人——包括儿童——都不有意收集个人数据。
§ 13Security安全措施
Credentials are stored in the iOS Keychain and protected by your device's hardware security. Sessions run over SSH's standard encryption. On first connect to a new host, DevPilot shows the server's SHA-256 key fingerprint and warns you if it ever changes — a defense against man-in-the-middle attacks. No credential is ever stored in plaintext outside the Keychain.
No system is perfectly secure, so keep your device passcode enabled and your iOS up to date. If you believe a host key warning you saw was unexpected, decline the connection and investigate before trusting that host again.
凭据存于 iOS 钥匙串，受你设备的硬件安全保护。会话走 SSH 标准加密。首次连接新主机时，DevPilot 会展示服务器的 SHA-256 密钥指纹，并在其发生变化时向你告警——这是针对中间人攻击的防线。任何凭据都不会在钥匙串之外以明文形式存储。
没有任何系统是绝对安全的，请保持设备密码开启、iOS 及时更新。如果你收到的主机密钥告警来得毫无道理，请拒绝连接并在查清原委之前不要再信任该主机。
§ 14Changes to this policy政策变更
If we change this policy, we will update the date at the top of this page and, for material changes, note them in the app's release notes. The version you are reading is always the current one at this address.
若本政策发生变更，我们会更新页面顶部的日期；对实质性变更，还会在 App 的版本说明中提示。本页面上的版本始终是当前有效版本。
§ 15Contact us联系我们
Questions about this policy or about data handling in DevPilot? Write to us: ericyuanovo@gmail.com
对本政策或 DevPilot 的数据处理有疑问？写信给我们：ericyuanovo@gmail.com
About this page. It is a static HTML file with no cookies, no tracking scripts, and no third-party requests — no external fonts, no analytics. Your visit is subject only to the standard practices of our hosting provider (Cloudflare), which may briefly process routine server logs for security and abuse prevention.
关于本页面。这是一个静态 HTML 页面：无 Cookie、无跟踪脚本、无任何第三方请求——没有外部字体，也没有统计。你的访问仅受我们托管服务商（Cloudflare）的惯例约束：为安全与防滥用目的，它可能短时处理常规服务器日志。